Legacy Equipment /

System Qualification

21St Annual Validation Week

October 2015

Yau Kai Wong

This presentation is the opinion expressed during this presentation are those of the

presenter and do not represent the views, policies or practices of my employer,

or regulatory agencies.

1. What is Legacy Equipment

2. Issues with Legacy Equipment

3. Regulatory Standards

4. Objective of Legacy

Equipment Qualification

5. Remediation / Qualification

Process

Agenda

Terminology Equipment

Apparatus used to conduct the

required process or test or a

piece of process equipment

(e.g., a mill or a centrifuge)

or to a containment system

to complete a major step of

a recipe step

System an organization of engineering

components, which have a

defined operational function,

e.g., piping, instrumentation,

processing equipment, facilities,

facilities, computer hardware,

computer software, etc.

Terminology cont’d

Qualification The practice of establishing

that equipment operatesas it was designed for its

intended use in a

reproducible manner

Validation Established documented

evidence which provides a high

degree of assurance that a

specific process will consistently

produce a product meeting its predetermined specifications

and quality attributes

Terminology cont’d

Verification

The process of evaluating

the products of a given

phase to ensure

correctness and

consistency with respect

to products and standards

provided as input to that

phase.

Legacy Equipment / System

Definition There is no formally accepted

definition for “Legacy”

equipment / system

GAMP Good Practice Guide

(PGP) – a “Legacy” system

should be considered to be

an GxP relevant system that is

in place and in use, and

which id deemed not to

satisfy current regulatory

expectations.

Legacy Equipment / System

Definition cont’d

In Computing, a legacy

system is an old method,

technology, computer

system, or application

program, “of relating to,

or being a previous or

outdated computer

system”

Reasons for Keeping a

Legacy Equipment / System The system works satisfactorily

The costs of redesigning or replacing

the system are prohibitive

Retraining on a new system would

be costly in lost time and money

The system requires near-consistent

availability

The way the system works is not well

understood

The user expects that the system

cab easily be replaced when this

becomes necessary

Newer systems perform undesirable

Disadvantages with Legacy

Equipment / System

Ownership of equipment /

system

Qualification / validation

documentation

Cost of maintenance

Hard to maintain

Integration with newer

equipment / systems

Equipment functionalities

Security / Data integrity

Data archival

Regulatory Standard

CFR – 21 CFR

ICH – GMP

Industry – ISPE, ASTM

Corporate – Policies,

Quality Manual,

SOPs, Directives

Objective of Legacy Equipment

/ System Qualification

To meet the requirement

that facilities, systems,

equipment and utilities

are properly qualified

and maintained to

assure data and product

integrity

Forms the starting point

for future change control

Objective of Legacy Equipment

/ System Qualification cont’d

To provide a framework to

demonstrate regulatory

compliance To ensure that the legacy

equipment / system

properly supports the

process

Objective of Legacy Equipment

/ System Qualification cont’d

Enhance confidence in the

engineering of the legacy

system

Potentially to reduce system

maintenance costs

Demonstrate that

users are

competent to operate the legacy

system

Objective of Legacy Equipment

/ System Qualification cont’d

To establish a complete

set of system

documentation providing

a precise definition of the

operating environment,

functionality, hardware

and software, procedures

and reference manuals

associated with the

legacy system

Qualification / Remediation

It is not possible to undertake the details of an Installation Qualification for established equipment / system nor the detailed approach for an Operational Qualification, nevertheless there should be data available that support and verify the operating parameters and limits foe the critical variables of the operating equipment

The calibration, cleaning, preventative maintenance, operating procedures, and operator training procedures for the use of the equipment should be documented and in use

Risk-based

Remediation / Qualification

Approach

Life Cycle

Risk-Based Approach Clearly communicate the risk

assessment objectives

Define the risk levels

high, medium, low

1, 2, 3

Other methods

Determine business process

criticality

Determine the test plan and

test cases The rigor / scale of testing should

reflect the risk determined

Verification

Life Cycle Approach

Requirement

Risk Assessment

Qualification

Configuration

Management

Change Management

Deviation Management

Requalification

Management

ISPE LifeCycle

Maintain the Validated State

Operational procedures

Change management

Security management

Incident management

Performance monitoring

Periodic review

Backup, recovery, and

disaster recovery

Retirement

Periodic Review

22

System ID # & location

Validation status

System security & access

Backup and restore &

decommissioning

Deviation

Change control

CAPAs

Audit trail

Case Study

• IV solution manufacturing company

• Packaging line

CSV Remediation

Remediation Process Flow

Remediation Process

Scope

Assessment

Planning

Qualification Specification

Configuration

Reporting

Gap Assessment Template

User Requirement

Specification

Can one go back to re-create

user requirement?

Is this a value added proposition?

What is the purpose of re-

creating the URS?

System DescriptionSystem 1

System 2

System 3

System Overview

ISPE: An Example of System Overview Diagram for Process and Data Flow of a HPLC

System Description /

Functional Specification

Template

Risk Assessment1. Business Risk

2. Patient Safety, Product Quality

Risk Assessment cont’d

Criticality of Functions

Likelihood of Occurrence

Risk Assessment cont’d

Likelihood of Detection

Example of Risk Assessment

Risk AssessmentMeasure(s) to Mitigate

Risk

Main Function

Sub-Function

Risk Scenario

Cause of Risk

Probability Occurrence

(L/M/H)

Impact(s) on Specified Function

Severity of Impact(L/M/H)

Risk Classification(Level 1/2/3)

Probability of Detection(L/M/H)

Risk Priority(H/M/L)

URS

Function 1 Sub-fct 1 Stop Not enough grease

M Machine not able to run

H 1 H M PM

Function 2 Data can be missing when the role is forwarded to approval

Technical L Role required data not completed

H 2 H L Test thoroughness

UR 1

FS # Hazard

Severity of Harm

Probability of Occurrence

Risk Assessment

Mitigation

Function 1 <Destruction of system due to power surge

Critical Low Medium Install the system onto a UPS

Function 2 Specialized/proprietary construction has limited replacements

Critical Low Medium

Function 3 Loss of system function due to network disruption

Major Low Low Local storage or backup>

Example of Risk Assessment

Qualification & Verification

Based on the assessed risk

Set up verification templates

Verify the intended functions

Perform additional tests

Follow the system lifecycle